{"data":{"id":"44403932-937b-4a55-aee9-3e7628aa478b","title":"GHSA-6fw7-3q8r-m5vj: FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment","summary":"GHSA-6fw7-3q8r-m5vj describes a Mass Assignment flaw in the FlowiseAI variable update endpoint, PUT /api/v1/variables/{variableId}. Authenticated users can send server-controlled fields such as workspaceId, createdDate and updatedDate, and the backend persists them without validation or authorization checks. An attacker can therefore reassign variables to arbitrary workspaces, which may break tenant isolation in multi-workspace deployments.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-6fw7-3q8r-m5vj","publishedAt":"2026-05-14T14:52:24.000Z","cveId":"CVE-2026-42861","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.1 (fixed: 3.1.2)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["FlowiseAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00254,"epssCheckedAt":"2026-11-07T18:08:34.352Z","kevDateAdded":null,"advisoryAliases":["GHSA-6fw7-3q8r-m5vj"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-14T14:52:24.000Z","fixReleasedAt":"2026-04-14T10:52:03.012Z","daysToFix":-30,"fixCheckedAt":"2026-10-29T21:36:26.737Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.2","matchedVersion":"3.1.2","fixReleasedAt":"2026-04-14T10:52:03.012Z","daysToFix":-30,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:26.589Z"}]}}